Required auditing parameters for database auditing should be set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-5685	DG0029-ORACLE11	SV-24615r2_rule	ECAR-1 ECAR-2 ECAR-3	Medium

Description
Oracle auditing can be set to log audit data to the database or operating system files. Logging events to the database prevents operating system users from viewing the data, while logging events to operating system files prevents malicious database users from accessing the data. The value NONE disables auditing and is, therefore, not in compliance with policy.

STIG	Date
Oracle Database 11g Instance STIG	2015-03-26

Details

Check Text ( C-1126r2_chk )
From SQL*Plus: select value from v$parameter where name = 'audit_trail'; If the value returned is NONE, this is a Finding.

Fix Text (F-22677r1_fix)
Enable database auditing. Select the desired audit trail format (external file or internal database table). From SQLPlus: alter system set audit_trail= [audit trail format] scope=spfile; Compliant selections for [audit trail format] are (per MetaLink Note 30690.1): Oracle 11.1 – 11.2 = 'true', 'os' & 'db' (true = os for backward compatibility) Oracle 11.1 – 11.2 = 'db_extended', 'xml' & 'xml, extended' The above SQLPlus command will set the parameter to take effect at next system startup.

Fix Text (F-22677r1_fix)

Enable database auditing.

Select the desired audit trail format (external file or internal database table).

From SQL*Plus:
alter system set audit_trail= [audit trail format] scope=spfile;

Compliant selections for [audit trail format] are (per MetaLink Note 30690.1):

Oracle 11.1 – 11.2 = 'true', 'os' & 'db' (true = os for backward compatibility)
Oracle 11.1 – 11.2 = 'db_extended', 'xml' & 'xml, extended'

The above SQL*Plus command will set the parameter to take effect at next system startup.